loader-PL1 (a): no plugin code under the connector stream lock or a host lock (M1); instance streams purged on fault/drop by MattJackson · Pull Request #671 · GetBusbar/busbar

MattJackson · 2026-10-08T02:41:06Z

Loader-PL1 (a): THE DESIGN §11.13 M1, no plugin code under a host lock, and connector streams purged on fault/drop.

connector: a framed request's auth call (fields_now), its poll and the open no longer run under held_conns; the stream is taken out (Conn::Opening), the work runs with the lock let go, install() swaps it back. A stream closed meanwhile has what was opened for it closed outside the lock.
loader: no plugin open/close/refresh under a host lock: hook quarantine trials (Trialing state), the shared secret instance, OutboundAuths::serving (facts read once, only the serving row bound, opened outside the map's lock via OpenOnce), and auth refresh (a refresh in flight answers the next caller at once).
connector: the RANDOM slot is retired (random.fill is the one random service; layout unchanged); IDENTITY never answers from a kept READY; an instance's held streams, facts and kept answers are purged by InstanceId when the watchdog faults it or it drops.

Merge of origin/predev: door_steps.rs conflicted with predev's OutboundAuths::check (rows_with(false), no needs granted). Resolved by keeping this branch's load/facts shape and adding load_with(name, door, conns); check walks the cached facts and loads only the row stating the style with ConnTable::NoNeeds, as predev's intended.

RED arms: listed in each commit message.

Proof (Latchkey cli-176f3105-7f18-48a2-9a9a-69b31a4eb684): fmt, workspace examples, clippy -D warnings, busbar-contract tests, abi-header, gates secret-hygiene and door-only all rc 0. Known runner-only failures: the two busbar_secret_env_plugin both-ways tests (cdylib not built) and ledger_identity (oracle creds). One more: declared_credentials::an_unpresentable_static_credential_logs_its_builders_own_line read a sibling bind's line (protocol=responsesin-bearer). That is the known auth-header open_outbound envelope race on the process's shared instance, fixed in p6-flakes-7 (busbar-auth-header 2310766). kind-isolation deps rows answered no-base because origin/predev moved during the job; CI runs it against the real base.

… DESIGN §11.13 M1) A framed request's end called its member binding's auth plugin (fields_now) and opened the request on the table while holding held_conns, the one process-wide lock over every instance's streams; the read that polls a pending auth call, and a raw write's open of an un-headed framed stream, did the same. A slow or wedged auth plugin then held every worker's connector I/O behind it, and an auth plugin calling back into the connector from inside fields relocked the same std Mutex on its own thread. The stream is now taken out (Conn::Opening) under the lock, the auth call, its poll and the open run with the lock let go, and install() swaps the result back in. A stream closed meanwhile is gone: what was opened for it is closed on the table, and a pending auth call it held is dropped, both outside the lock. Any other call on a stream being opened is refused. RED: the member's on-the-spot auth call and its open, the polled pending auth call and its open, and a raw write's open each record whether the calling thread held the lock (a bounded try_lock that only this thread's own hold never releases); a stream closed while it opens leaves nothing open.

…DESIGN §11.13 M1) Four more places ran plugin code holding a lock other callers need: - hook_door: a quarantine's trial bound (dlopen) and opened its fresh instance, and closed a faulted one, holding the hook's state lock; a wedged trial held every caller of the hook, quarantined() included. The trial now moves the state to Trialing, binds and opens with the lock let go, and swaps the answer in; callers that find a trial in flight wait for it within their own budget. Closes happen after the lock is let go; Drop closes without locking. - secret_calls: a linked module's shared instance was bound and opened holding the shared map's lock. - door_steps (OutboundAuths::serving): OutboundInstance::open_with ran under the opened map's mutex, and every serving re-loaded and re-bound every auth row. The rows' outbound facts are now read once (outbound_styles), only the serving row is bound, and only when its instance is not open yet. - auth_door refresh: a refresh crossing ran under the instance's lifecycle lock, so a wedged refresh parked every later refresh caller; a refresh in flight now answers the next caller at once, naming it. The secret and auth-binding maps share one helper, OpenOnce: look up under the lock, open with it let go, swap in; of two racing first opens the first installed is kept and the other dropped outside the lock. RED: a hook whose trial bind is wedged still answers quarantined() and then serves; a shared secret open wedged in its plugin (its dispatcher ask gated) holds no second caller; a refresh wedged in the plugin answers a second refresh at once; OpenOnce's wedged open holds no other key or held key.

…ADY; an instance's streams are purged when it faults or is dropped - The connector's RANDOM slot is RETIRED: random.fill (op RANDOM_FILL, a host service) is the one random service. The slot keeps its number and place in ConnectorSlots (layout unchanged), the host serves it as NULL, and the contract and C header say so. No in-tree or sibling plugin calls it. Under the replay rule a kept RANDOM answered READY on a re-issued handle without filling the new buffer. - IDENTITY writes the caller's memory and never pends: it runs afresh on a replayed handle instead of answering the kept READY over memory nothing wrote (THE DESIGN §11.12). - Bounded memory: the connector's process-wide maps (held streams, their facts, kept answers) were cleared only by the plugin's own close. They are now purged by InstanceId when the watchdog faults the instance (both fault paths) and when the instance drops (a close let go, a reload); a held stream's open connection is closed on the table, outside the maps' locks (§11.13 M1). RED: a replayed IDENTITY handle writes the identity into the second call's memory; the connector serves no RANDOM; a dropped instance leaves no stream on the maps and its open connection is closed on the table.

# Conflicts: # crates/busbar/src/root/door_steps.rs

…11 -> 110 (the secret shared-instance open moved to OpenOnce); the header's sum is 4462

github-actions · 2026-10-08T04:16:04Z

promote into `predev`: DENY @8a2355a11: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

gate	row	detail
construction	`one-pick-site`	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	`kind-isolation:deps`	3 finding(s), 93 shipped edge instance(s) over 30 class(es), 93 declaration(s); 56 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	`kind-isolation:test-deps`	3 finding(s), 35 test edge instance(s) over 21 class(es), 35 declaration(s); 20 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation	`kind-isolation:law0`	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	`kind-isolation:deps`	10 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	`kind-isolation:test-deps`	10 finding(s) over 35 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	`kind-isolation:law0`	11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35: this landing grew a neutral crate's instance vocabular
kind-isolation-ship	`kind-isolation:faces`	2 finding(s) over 40 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	`kind-isolation:legacy-drain`	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	`ship-ready:ship-twin`	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	`structure-lint:plane-dup:unledgered`	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Denied because (2)

shard 1/4: armed red: gate:kind-isolation row kind-isolation:law0: a ledger row this candidate arms is red at its own tree (Law 9: arm at today's number): 11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling of 35:
shard 1/4: armed red: gate:kind-isolation-ship row kind-isolation:law0: a ledger row this candidate arms is red at its own tree (Law 9: arm at today's number): 11 hit(s) off the [[law0]] ceilings, 5 finding(s) over 14 neutral crate(s): law0-rise busbar × instance:secret 37 hit(s) against a ceiling o

Judged against base 477c11d3d: 0 new red, 0 worse, 3 standing (excused).

tests passed: 24476, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/38107129769 . Artifact verdict-8a2355a11ac10fd408c68d80273612cf3c53c567 (failures.json, junit.xml, raw.log; 90 days).

…en with predev's instance label; keep both sides' tests; outbound test stand-in uses outbound_styles

…ce load path, adapt to predev's 3-tuple LinkedAuth

…m predev, sum lowered by this branch's 111->110 drain

…sage busbar-plugin-loader x plane rose 47 -> 48 (figure 11 -> 12 on both twins). The one new hit is the assert message "a dropped instance's streams stayed on the connector's map" in conn_services_tests.rs: `streams` is the streaming plane's alias, and in a string literal the English-prose mask does not apply. Reworded to "stream entries"; the comment uses of the word are prose and already masked. Not proved on Latchkey (run budget spent, RUN_CAP); reasoned from the CI verdict artifact's law0 detail (base 11 vs head 12: only the loader plane cell differs).

MattJackson · 2026-10-10T23:37:48Z

RULING (architect, Law 9, docs/design/BUSBAR-1.6.0.md l.2082-2097: "pins its ceiling at TODAY'S MEASURED VALUE and refuses every rise ... The drain runs behind it, ratcheting the ceiling down"): kind-isolation is judged PER CELL, no-worse-than-base. A PR may not raise any cell above its base; a cell it lowers takes the new, lower ceiling. Lowering or striking one [[law0]] row does NOT arm the whole row, and a PR is NOT required to drain predev's unrelated standing over-ceiling cells. Those are predev's own reds, owned by kind-isolation:law0-base (#747) and drained by their own lanes. No ceiling rises. If the engine's armed-red rule still judges the whole row, that is an engine defect being fixed in busbar-release now; this PR proceeds on its own cells.

…h measures (Law 9) The three gate selftests red on #671 (blocking-ffi, response-header, settings-leak; green at base 17b55f9) share one plant, population::one_file_short: the live population with one file removed must be refused by FLOOR. The base measures 941 non-test .rs under crates/; this branch adds exactly one (crates/plugin-loader/src/open_once.rs; open_once_tests.rs is test scaffolding) and deletes none, so it measures 942 and the plant's 941 cleared a floor of 941: the positive control could not fail. RULING: a census floor pins at TODAY'S MEASURED VALUE (BUSBAR-1.6.0.md l.2089-2092, Law 9), so FLOOR is re-pinned at 942. Raised with the tree, never lowered; no gate or plant weakened. kind-isolation:law0 / kind-isolation-ship:law0 'armed red' (busbar x instance:secret 37 vs 35) is not this branch's: kind-isolation:law0-base, the per-cell did-this-branch-grow-a-cell row, is green, and the verdict lists law0 as standing. It reads armed only because this branch lowers busbar-plugin-loader x instance:secret 111 -> 110 as Law 9 requires (l.2093: the drain ratchets the ceiling down). Per the architect's ruling on #671 (per cell, no-worse-than-base; no ceiling rises) that is the engine's whole-row arming, fixed in busbar-release 5a1380d (on dev, not yet on main/pinned). No ceiling is raised here. RED arm: at FLOOR 941 the three selftests fail on this tree (CI run 38096890834, shards 2-4); at 942 the one-file-short plant is refused.

…omputed floor plant The one conflict was xtask/src/gates/population.rs. This branch re-pinned FLOOR 941 -> 942 (c9e1d97) for one reason only: the fixed one-file-short plant measured 941 on a 942-file tree and could not fail. predev's 9ae787f replaced that plant with Overlay::below_floor, which cuts the live population to FLOOR - 1 at any tree size, so the re-pin is no longer needed for the plant to be refused, and keeping it would re-conflict on every predev merge that touches the same ratchet lines. RULING: take predev's file whole (FLOOR 941, computed cut, its tests). A census floor pins at the measured value when it is armed and refuses every drop (BUSBAR-1.6.0.md Law 9, l.2089-2093); it does not have to be re-pinned each time the tree grows. 941 is not a drop: the merged tree measures above it. No gate, plant or test is weakened.

Brings predev 86771f6 (#671 loader-pl1-a, #608 kernel-scope, #790). Conflicts: - crates/busbar-a2a/src/a2a/creds.rs: stays deleted with the crate. Predev's change struck the engine's REQUIRE_LIVE_KEY (#608: key liveness is the gate's for every plane); busbar-plane-a2a has no EgressSubject impl, so nothing carries it. - plugin-loader conn_services.rs: predev's request path (the request taken out of the map, the open run with the connector's lock let go) carrying this branch's member-keyed binding, the plugin's waiver, the per-request handle and its CredentialUnavailable refusal; the unused RandomIn import is dropped with #671's random service. - conn_services_tests.rs: the Scripted double keeps predev's auth and lock probe beside this branch's member_auth; auth_of answers the member binding, else predev's; this branch's four-argument request helper is whole_request_with, beside predev's whole_request. - qa/kind-isolation.toml, busbar-plugin-loader x instance:secret: predev's row kept (111 -> 110, #671 drained the random service's extern C fn), with this PR's extern-ABI scanner fix re-applied: 25, as measured on #787's tree, the extern C hit #671 removed being one the fix no longer counts.

Brings predev 86771f6. Conflict: qa/kind-isolation.toml, busbar-plugin-loader x instance:secret: predev's row (111 -> 110, #671) kept, with this PR's own drain re-applied (the raw JSON-lane loader and the cold auth lane deleted, 2 hits): 108.

…t helper is whole_request_with The predev 86771f6 merge brought #671's two-argument whole_request into the same module as this branch's four-argument one; the rename was resolved but left out of that merge commit, so the module defined the function twice.

Brings predev 350e107 (#727). Conflict: qa/kind-isolation.toml, busbar-plugin-loader x instance:secret: predev's row (109, its two drains cited) kept, with this PR's own delta applied: the extern-ABI scanner fix, -86 as measured on #787's tree (111 -> 25), so 109 - 86 = 23. Neither predev drain is an extern ABI string. The earlier 25 assumed #671's drain was one; predev's cite names it as the OpenOnce move, so it was not.

Brings predev c89729d (#798). Conflict: qa/kind-isolation.toml, busbar-kernel x plane, by the ledger merge rule: base 1168, predev 1141 (row 157: the HOT trust and guard slots deleted), this branch 1145 (FLIP-A2A's own drain); the two sides drain different lines, so 1141 + 1145 - 1168 = 1118, predev's cite kept and this branch's clause appended with the new numbers. The plugin-loader x instance:secret cite is corrected to its arithmetic (coordinator ruling): 109 - 85 = 24, the 86 extern ABI strings including #671's 111 -> 110; -1 for the durable_tests.rs directory rename = 23.

MattJackson added 4 commits October 7, 2026 13:24

Merge remote-tracking branch 'origin/predev' into loader-pl1-a

a63d24f

# Conflicts: # crates/busbar/src/root/door_steps.rs

MattJackson enabled auto-merge October 8, 2026 02:41

Merge remote-tracking branch 'origin/predev' into loader-pl1-a

09e5185

MattJackson mentioned this pull request Oct 8, 2026

loader-PL1 (d): a late completion never lands on the next op's handle; a failed open publishes no instance; dead pub items deleted #678

Merged

kind-isolation:law0: busbar-plugin-loader × instance:secret drained 1…

f664bca

…11 -> 110 (the secret shared-instance open moved to OpenOnce); the header's sum is 4462

MattJackson added the fixing label Oct 10, 2026

MattJackson added 2 commits October 9, 2026 19:59

Merge origin/predev into loader-pl1-a: keep OpenOnce shared secret op…

c4be33d

…en with predev's instance label; keep both sides' tests; outbound test stand-in uses outbound_styles

Merge remote-tracking branch 'origin/predev' into loader-pl1-a

2df26db

MattJackson added fixing and removed fixing labels Oct 10, 2026

Merge origin/predev into loader-pl1-a: keep the OnceLock facts/OpenOn…

c8e3eab

…ce load path, adapt to predev's 3-tuple LinkedAuth

MattJackson removed the fixing label Oct 10, 2026

MattJackson added this pull request to the merge queue Oct 10, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Oct 10, 2026

MattJackson added the fixing label Oct 10, 2026

Merge origin/predev into loader-pl1-a: kind-isolation law0 header fro…

ee0be89

…m predev, sum lowered by this branch's 111->110 drain

MattJackson added fixing and removed fixing labels Oct 10, 2026

MattJackson added 2 commits October 10, 2026 04:29

Merge remote-tracking branch 'origin/predev' into loader-pl1-a

02a13ca

MattJackson removed the fixing label Oct 10, 2026

Merge branch 'predev' into loader-pl1-a

6b47c5b

MattJackson added this pull request to the merge queue Oct 10, 2026

MattJackson removed this pull request from the merge queue due to a manual request Oct 10, 2026

MattJackson added the fixing label Oct 10, 2026

Merge origin/predev into loader-pl1-a

7c7b6fd

MattJackson added fixing and removed fixing labels Oct 10, 2026

Merge origin/predev into loader-pl1-a

a7c9e0e

MattJackson added fixing and removed fixing labels Oct 10, 2026

MattJackson removed the fixing label Oct 10, 2026

Merge branch 'predev' into loader-pl1-a

27771f0

MattJackson enabled auto-merge October 11, 2026 00:05

MattJackson added the fixing label Oct 11, 2026

MattJackson removed the fixing label Oct 11, 2026

MattJackson disabled auto-merge October 11, 2026 01:17

MattJackson added 2 commits October 10, 2026 18:17

Merge branch 'predev' into loader-pl1-a

fdc7051

Merge branch 'predev' into loader-pl1-a

98498eb

MattJackson added the fixing label Oct 11, 2026

MattJackson removed the fixing label Oct 11, 2026

MattJackson merged commit 86771f6 into predev Oct 13, 2026
8 of 10 checks passed

MattJackson deleted the loader-pl1-a branch October 13, 2026 04:03

Navigation Menu

Repository navigation

loader-PL1 (a): no plugin code under the connector stream lock or a host lock (M1); instance streams purged on fault/drop - #671

loader-PL1 (a): no plugin code under the connector stream lock or a host lock (M1); instance streams purged on fault/drop#671
MattJackson merged 20 commits into
predevfrom
loader-pl1-a

MattJackson commented Oct 8, 2026

Uh oh!

github-actions Bot commented Oct 8, 2026 •

edited

Loading

Uh oh!

MattJackson commented Oct 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

MattJackson commented Oct 8, 2026

Uh oh!

github-actions Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

promote into predev: DENY @8a2355a11: 0 failing test row(s), 11 DENY row(s)

DENY rows (11)

Uh oh!

MattJackson commented Oct 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Oct 8, 2026 •

edited

Loading

promote into `predev`: DENY @8a2355a11: 0 failing test row(s), 11 DENY row(s)